×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
nagulan_s
Loves-to-Learn Everything
Member since: ‎06-06-2022
‎06-07-2022
Community Statistics
Posts 6
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎06-06-2022
View All

Re: Extract all regex matches as a list in each lo...

by in Splunk Search
‎06-07-2022 12:23 AM
‎06-07-2022 12:23 AM
@gcusello  You can maybe take the example from here https://community.splunk.com/t5/Splunk-Search/How-to-extract-multiple-values-from-a-single-field-if-they-exist/m-p/309126. My doubt is exactly the same but in the answer section they didnt use rex, maybe can you give me a solution with rex for the same question ... View more

Re: Extract all regex matches as a list in each lo...

by in Splunk Search
‎06-07-2022 12:13 AM
‎06-07-2022 12:13 AM
Why do you think there maybe a problem in the regex? I am able to extract all the regex matches in each log, but the problem is each match is displayed as a separate row, I want all regex match in a single log in a row itself. ... View more

Re: Extract all regex matches as a list in each lo...

by in Splunk Search
‎06-06-2022 11:55 PM
‎06-06-2022 11:55 PM
This is what I am using. and the result is like the table in the above reply. | rex max_match=0 field=ErrorMessage "Time spent on step (?<stepID>.*) : " | table Messages, UMID, stepID   ... View more

Re: Extract all regex matches as a list in each lo...

by in Splunk Search
‎06-06-2022 11:43 PM
‎06-06-2022 11:43 PM
I tried something like this but the output is not as expected. Expected output: Message                                                          ID     TT ... tt_1 ... tt_2 ... tt_9 ... tt_3                        1       tt_1 tt_2 tt_9 tt_3   Output from your suggestion: Message                                                          ID     TT ... tt_1 ... tt_2 ... tt_9 ... tt_3                        1       tt_1  ... tt_1 ... tt_2 ... tt_9 ... tt_3                        1       tt_2  ... tt_1 ... tt_2 ... tt_9 ... tt_3                        1       tt_9  ... View more

Extract all regex matches as a list in each log

by in Splunk Search
‎06-06-2022 11:01 PM
‎06-06-2022 11:01 PM
Input: Message                                                          ID ... tt_1 ... tt_2 ... tt_9 ... tt_3                        1 ... tt_6 ... tt_4 ... tt_5                                      2   Ouput: Message                                                          ID     TT ... tt_1 ... tt_2 ... tt_9 ... tt_3                        1       tt_1 tt_2 tt_9 tt_3 ... tt_6 ... tt_4 ... tt_5                                      2.     tt_6 tt_4 tt_5 In the above "Message" field the "..." indicates some random text in between. So basically I want to extract all words starting with "tt_" and display it as in the table shown above. Can anyone help be with the splunk query of it. ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎06-07-2022 04:39 AM